6Lo Working Group C. Bormann
Internet-Draft Universitaet Bremen TZI
Intended status: Standards Track September 19, 2014
Expires: March 23, 2015
6LoWPAN Generic Compression of Headers and Header-like Payloads (GHC)
draft-ietf-6lo-ghc-05
Abstract
This short specification provides a simple addition to 6LoWPAN Header
Compression that enables the compression of generic headers and
header-like payloads, without a need to define a new header
compression scheme for each new such header or header-like payload.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on March 23, 2015.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Bormann Expires March 23, 2015 [Page 1]

Internet-Draft 6lowpan-ghc September 20141.2. Compression Approach
The basic approach of GHC's compression function is to define a
bytecode for LZ77-style compression [LZ77]. The bytecode is a series
of simple instructions for the decompressor to reconstitute the
uncompressed payload. These instructions include:
o appending bytes to the reconstituted payload that are literally
given with the instruction in the compressed data
o appending a given number of zero bytes to the reconstituted
payload
o appending bytes to the reconstituted payload by copying a
contiguous sequence from the payload being reconstituted
("backreferencing")
o an ancillary instruction for setting up parameters for the
backreferencing instruction in "decompression variables"
o a stop code (optional, see Section 3.2)
The buffer for the reconstituted payload ("destination buffer") is
prefixed by a predefined dictionary that can be used in the
backreferencing as if it were a prefix of the payload. This
predefined dictionary is built from the IPv6 addresses of the packet
being reconstituted, followed by a static component, the "static
dictionary".
As usual, this specification defines the decompressor operation in
detail, but leaves the detailed operation of the compressor open to
implementation. The compressor can be implemented as with a
classical LZ77 compressor, or it can be a simple protocol encoder
that just makes use of known compression opportunities.
1.3. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in RFC2119 [RFC2119].
The term "byte" is used in its now customary sense as a synonym for
"octet".
Terms from [RFC7228] are used in Section 5.
Bormann Expires March 23, 2015 [Page 3]

Internet-Draft 6lowpan-ghc September 20141.4. Notation
This specification uses a trivial notation for code bytes and the
bitfields in them, the meaning of which should be mostly obvious.
More formally, the meaning of the notation is:
Potential values for the code bytes themselves are expressed by
templates that represent 8-bit most-significant-bit-first binary
numbers (without any special prefix), where 0 stands for 0, 1 for 1,
and variable segments in these code byte templates are indicated by
sequences of the same letter such as kkkkkkk or ssss, the length of
which indicates the length of the variable segment in bits.
In the notation of values derived from the code bytes, 0b is used as
a prefix for expressing binary numbers in most-significant-bit first
notation (akin to the use of 0x for most-significant-digit-first
hexadecimal numbers in the C programming language). Where the above-
mentioned sequences of letters are then referenced in such a binary
number in the text, the intention is that the value from these
bitfields in the actual code byte be inserted.
Example: The code byte template
101nssss
stands for a byte that starts (most-significant-bit-first) with the
bits 1, 0, and 1, and continues with five variable bits, the first of
which is referenced as "n" and the next four are referenced as
"ssss". Based on this code byte template, a reference to
0b0ssss000
means a binary number composed from a zero bit, the four bits that
are in the "ssss" field (for 101nssss, the four least significant
bits) in the actual byte encountered, kept in the same order, and
three more zero bits.
Bormann Expires March 23, 2015 [Page 4]

Internet-Draft 6lowpan-ghc September 2014
These 48 dictionary bytes are therefore available for
backreferencing, but not copied into the final reconstituted payload.
16 fe fd 17 fe fd 00 01 00 00 00 00 00 01 00 00
Figure 1: The 16 bytes of static dictionary (in hex)
3. Integrating 6LoWPAN-GHC into 6LoWPAN-HC
6LoWPAN-GHC plugs in as an NHC format for 6LoWPAN-HC [RFC6282].
3.1. Compressing payloads (UDP and ICMPv6)
GHC is by definition generic and can be applied to different kinds of
packets. Many of the examples given in Appendix A are for ICMPv6
packets; a single NHC value suffices to define an NHC format for
ICMPv6 based on GHC (see below).
In addition it is useful to include an NHC format for UDP, as many
headerlike payloads (e.g., DHCPv6, DTLS) are carried in UDP.
[RFC6282] already defines an NHC format for UDP (11110CPP). GHC uses
an analogous NHC byte formatted as shown in Figure 2. The difference
to the existing UDP NHC specification is that for 0b11010cpp NHC
bytes, the UDP payload is not supplied literally but compressed by
6LoWPAN-GHC.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| 1 | 1 | 0 | 1 | 0 | C | P |
+---+---+---+---+---+---+---+---+
Figure 2: NHC byte for UDP GHC (to be allocated by IANA)
To stay in the same general numbering space, we use 0b11011111 as the
NHC byte for ICMPv6 GHC (Figure 3).
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| 1 | 1 | 0 | 1 | 1 | 1 | 1 | 1 |
+---+---+---+---+---+---+---+---+
Figure 3: NHC byte for ICMPv6 GHC (to be allocated by IANA)
3.2. Compressing extension headers
Compression of specific extension headers is added in a similar way
(Figure 4) (however, probably only EID 0 to 3 need to be assigned).
As there is no easy way to extract the length field from the GHC-
Bormann Expires March 23, 2015 [Page 6]

Internet-Draft 6lowpan-ghc September 2014
encoded header before decoding, this would make detecting the end of
the extension header somewhat complex. The easiest (and most
efficient) approach is to completely elide the length field (in the
same way NHC already elides the next header field in certain cases)
and reconstruct it only on decompression. To serve as a terminator
for the extension header, the reserved bytecode 0b10010000 has been
assigned as a stop marker. Note that the stop marker is only needed
for extension headers, not for the final payloads discussed in the
previous subsection, the decompression of which is automatically
stopped by the end of the packet.
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
| 1 | 0 | 1 | 1 | EID |NH |
+---+---+---+---+---+---+---+---+
Figure 4: NHC byte for extension header GHC
3.3. Indicating GHC capability
The 6LoWPAN baseline includes just [RFC4944], [RFC6282], [RFC6775]
(see [I-D.bormann-6lo-6lowpan-roadmap]). To enable the use of GHC
towards a neighbor, a 6LoWPAN node needs to know that the neighbor
implements it. While this can also simply be administratively
required, a transition strategy as well as a way to support mixed
networks is required.
One way to know a neighbor does implement GHC is receiving a packet
from that neighbor with GHC in it ("implicit capability detection").
However, there needs to be a way to bootstrap this, as nobody ever
would start sending packets with GHC otherwise.
To minimize the impact on [RFC6775], we define an ND option 6LoWPAN
Capability Indication (6CIO), as illustrated in Figure 5. (For the
fields marked by an underscore in Figure 5, see Section 3.4.)
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length = 1 |_____________________________|G|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|_______________________________________________________________|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 5: 6LoWPAN Capability Indication Option (6CIO)
The G bit indicates whether the node sending the option is GHC
capable.
Bormann Expires March 23, 2015 [Page 7]

Internet-Draft 6lowpan-ghc September 2014
Once a node receives either an explicit or an implicit indication of
GHC capability from another node, it may send GHC-compressed packets
to that node. Where that capability has not been recently confirmed,
similar to the way PLPMTUD [RFC4821] finds out about changes in the
network, a node SHOULD make use of NUD (neighbor unreachability
detection) failures to switch back to basic 6LoWPAN header
compression [RFC6282].
3.4. Using the 6CIO Option
The 6CIO option will typically only be ever sent in 6LoWPAN-ND RS
packets (which cannot itself be GHC compressed unless the host
desires to limit itself to talking to GHC capable routers). The
resulting 6LoWPAN-ND RA can then already make use of GHC and thus
indicate GHC capability implicitly, which in turn allows both nodes
to use GHC in the 6LoWPAN-ND NS/NA exchange.
6CIO can also be used for future options that need to be negotiated
between 6LoWPAN peers; an IANA registry is used to assign the flags.
Bits marked by underscores in Figure 5 are unassigned and available
for future assignment. They MUST be sent as zero and MUST be ignored
on reception until assigned by IANA. Length values larger than 1
MUST be accepted by implementations in order to enable future
extensions; the additional bits in the option are then deemed
unassigned in the same way. For the purposes of the IANA registry,
the bits are numbered in most-significant-bit-first order from the
16th bit of the option onward: the 16th bit is flag number 0, the
31st bit (the G bit) is flag number 15, up to the 63rd bit for flag
number 47. (Additional bits may also be used by a follow-on version
of this document if some bit combinations that have been left
unassigned here are then used in an upward compatible manner.)
Flag numbers 0 to 7 are reserved for experiments. They MUST NOT be
used for actual deployments.
Where the use of this option by other specifications or by
experiments is envisioned, the following items have to be kept in
mind:
o The option can be used in any ND packet.
o Specific bits are set in the option to indicate that a capability
is present in the sender. (There may be other ways to infer this
information, as is the case in this specification.) Bit
combinations may be used as desired. The absence of the
capability _indication_ is signaled by setting these bits to zero;
this does not necessarily mean that the capability is absent.
Bormann Expires March 23, 2015 [Page 8]

Internet-Draft 6lowpan-ghc September 2014
o The intention is not to modify the semantics of the specific ND
packet carrying the option, but to provide the general capability
indication described above.
o Specifications have to be designed such that receivers that do not
receive or do not process such a capability indication can still
interoperate (presumably without exploiting the indicated
capability).
o The option is meant to be used sparsely, i.e. once a sender has
reason to believe the capability indication has been received,
there no longer is a need to continue sending it.
4. IANA considerations
[This section to be removed/replaced by the RFC Editor.]
In the IANA registry for the "LOWPAN_NHC Header Type" (in the "IPv6
Low Power Personal Area Network Parameters"), IANA is requested to
add the assignments in Figure 6.
10110IIN: Extension header GHC [RFCthis]
11010CPP: UDP GHC [RFCthis]
11011111: ICMPv6 GHC [RFCthis]
Figure 6: IANA assignments for the NHC byte
IANA is requested to allocate an ND option number for the "6LoWPAN
Capability Indication Option (6CIO)" ND option format in the Registry
"IPv6 Neighbor Discovery Option Formats" [RFC4861].
IANA is requested to create a subregistry for "6LoWPAN capability
bits" within the "Internet Control Message Protocol version 6
(ICMPv6) Parameters". The bits are assigned by giving their numbers
as small non-negative integers as defined in section Section 3.4,
preferably in the range 0..47. The policy is "IETF Review" or "IESG
Approval" [RFC5226]. The initial content of the registry is as in
Figure 7:
0..7: reserved for experiments [RFCthis]
8..14: unassigned
15: GHC capable bit (G bit) [RFCthis]
16..47: unassigned
Figure 7: IANA assignments for the 6LoWPAN capability bits
Bormann Expires March 23, 2015 [Page 9]

Internet-Draft 6lowpan-ghc September 20145. Security considerations
The security considerations of [RFC4944] and [RFC6282] apply. As
usual in protocols with packet parsing/construction, care must be
taken in implementations to avoid buffer overflows and in particular
(with respect to the back-referencing) out-of-area references during
decompression.
One additional consideration is that an attacker may send a forged
packet that makes a second node believe a third victim node is GHC-
capable. If it is not, this may prevent packets sent by the second
node from reaching the third node (at least until robustness features
such as those discussed in Section 3.3 kick in).
No mitigation is proposed (or known) for this attack, except that a
victim node that does implement GHC is not vulnerable. However, with
unsecured ND, a number of attacks with similar outcomes are already
possible, so there is little incentive to make use of this additional
attack. With secured ND, 6CIO is also secured; nodes relying on
secured ND therefore should use 6CIO bidirectionally (and limit the
implicit capability detection to secured ND packets carrying GHC)
instead of basing their neighbor capability assumptions on receiving
any kind of unprotected packet.
As with any LZ77 scheme, decompression bombs (compressed packets
crafted to expand so much that the decompressor is overloaded) are a
problem. An attacker cannot send a GHC decompressor into a tight
loop for too long, because the MTU will be reached quickly. Some
amplification of an attack from inside the compressed link is
possible, though. Using a constrained node in a constrained network
as a DoS attack source is usually not very useful, though, except
maybe against other nodes in that constrained network. The worst
case for an attack to the outside is a not-so-constrained device
using a (typically not-so-constrained) edge router to attack by
forwarding out of its Ethernet interface. The worst-case
amplification of GHC is 17, so an MTU-size packet can be generated
from a 6LoWPAN packet of 76 bytes. The 6LoWPAN network is still
constrained, so the amplification at the edge router turns an entire
250 kbit/s 802.15.4 network (assuming a theoretical upper bound of
225 kbit/s throughput to a single-hop adjacent node) into a 3.8 Mbit/
s attacker.
The amplification may be more important inside the 6LoWPAN, if there
is a way to obtain reflection (otherwise the packet is likely to
simply stay compressed on the way and do little damage), e.g., by
pinging a node using a decompression bomb, somehow keeping that node
from re-compressing the ping response (which would probably require
something more complex than simple runs of zeroes, so the worst-case
Bormann Expires March 23, 2015 [Page 10]

Internet-Draft 6lowpan-ghc September 2014
amplification is likely closer to 9). Or, if there are nodes that do
not support GHC, those can be attacked via a router that is then
forced to decompress.
All these attacks are mitigated by some form of network access
control.
In a 6LoWPAN stack, sensitive information will normally be protected
by transport or application (or even IP) layer security, which are
all above the adaptation layer, leaving no sensitive information to
compress at the GHC level. However, a 6LoWPAN deployment that
entirely depends on MAC layer security may be vulnerable to attacks
that exploit redundancy information disclosed by compression to
recover information about secret values. The attacker would need to
be in radio range to observe the compressed packets. Since
compression is stateless, the attacker would need to entice the party
sending the secret value to also send some value controlled (or at
least usefully varying and knowable) by the attacker in (what becomes
the first adaptation layer fragment of) the same packet. This attack
is fully mitigated by not exposing secret values to the adaptation
layer, or by not using GHC in deployments where this is done.
6. Acknowledgements
Colin O'Flynn has repeatedly insisted that some form of compression
for ICMPv6 and ND packets might be beneficial. He actually wrote his
own draft, [I-D.oflynn-6lowpan-icmphc], which compresses better, but
addresses basic ICMPv6/ND only and needs a much longer spec (around
17 pages of detailed spec, as compared to the single page of core
spec here). This motivated the author to try something simple, yet
general. Special thanks go to Colin for indicating that he indeed
considers his draft superseded by the present one.
The examples given are based on pcap files that Colin O'Flynn, Owen
Kirby, Olaf Bergmann and others provided.
Using these pcap files as a corpus, the static dictionary was
developed, and the bit allocations validated, based on research by
Sebastian Dominik.
Erik Nordmark provided input that helped shaping the 6CIO option.
Thomas Bjorklund proposed simplifying the predefined dictionary.
Yoshihiro Ohba insisted on clarifying the notation used for the
definition of the bytecodes and their bitfields. Ulrich Herberg
provided some additional review and suggested expanding the
introductory material, and with Hannes Tschofenig and Brian Haberman
Bormann Expires March 23, 2015 [Page 11]

Internet-Draft 6lowpan-ghc September 2014
he helped come up with the IANA policy for the "6LoWPAN capability
bits" assignments in the 6CIO option.
The IESG reviewers Richard Barnes and Stephen Farrell have
contributed issues to the security considerations section; they and
Barry Leiba, as well as GEN-ART reviewer Vijay K. Gurbani also have
provided editorial improvements.
Bormann Expires March 23, 2015 [Page 12]